Doing path joining 'properly'
Adding CSRF protection before we forget